diff --git a/SecurityPolicy.html b/SecurityPolicy.html index 240e5d8..477dc85 100644 --- a/SecurityPolicy.html +++ b/SecurityPolicy.html @@ -48,6 +48,7 @@ a:hover {
This Policy explicitly defers detailed security practices to the -Security Manual +Security Manual ("SM"). The SM says how things are done. As practices are things that vary from time to time, @@ -244,7 +245,7 @@ explicitly defer single, cohesive components of the security practices into separate procedures documents. Each procedure should be managed in a wiki page under their control, probably at - + SystemAdministration/Procedures. Each procedure must be referenced explicitly in the Security Manual.
@@ -1351,12 +1352,11 @@ and becomes your authority to act.Components may be outsourced. + Team leaders may outsource non-critical components on notifying the Board. Critical components must be approved by the Board. -
- -+ Any outsourcing arrangements must be documented. All arrangements must be:
@@ -1386,9 +1386,11 @@ All arrangements must be:Contracts should be written with the above in mind. + +Outsourcing of critical components must be approved by the Board. +
-